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Abstract — In this paper, we study the problem of rooting out 
a single rumor source: supposing that a rumor, which originates 
from one node among a set of suspect nodes in a network, is 
spreading across the network following the susceptible-infected 
(SI) model, how can we and how well can we identify this rumor 
source? With the a priori knowledge of the set of suspect nodes 
and a snapshot observation of infected nodes, we construct a 
maximum a posteriori (MAP) estimator to identify the rumor 
source. For regular tree-type networks, we establish exact and 
asymptotic results on the detection probability of the source 
estimator. In particular, if the network is not linear, we have the 
following asymptotic results of the correct detection probability: 
First, when every infected node belongs to the suspect set, it 
grows from 0.25 to 0.307 as the node degree increases from three 
to infinity, a result first established in |1|, |2| via a different 
approach. Second, when the suspect nodes form a connected 
subgraph of the network, it significantly exceeds the a priori 
probability, and reliable detection is achieved as the node degree 
becomes large. Third, when there are only two suspect nodes, 
it is at least 0.75 and increases with the distance between the 
two nodes. Our analysis leverages ideas from the Polya's urn 
model and sheds insight into the behavior of the rumor spreading 
process. 

Index Terms — maximum a posteriori estimation, Polya's urn 
model, rumor spreading, social network, susceptible-infectious 
model. 

I. Introduction 

Spreading of epidemics, information, ideas and innovations 
through social networks is ubiquitous in the modern world 
10, 0, such as propagation of diseases and immunization, 
information diffusion through cyberspaces, upsurge of hot 
research topics, and adoption of medical and agricultural 
innovations. In general, any of these situations can be modeled 
as a rumor spreading process through a network (TJ, Q. In 
order to control, accelerate or prevent these spreadings, a key 
challenge is to identify the rumor source only based on the 
knowledge of network structure and the observation of infected 
nodes. 

In many practical scenarios, there does exist some a priori 
knowledge that certain nodes are more likely to be the rumor 
source and the others are less likely so, and there are many 
situations that only a handful of nodes in the network have the 
potential to initiate a rumor spreading process. When a disease 
among human beings is spread from cities to cities, only the 
travellers from earlier infected cities may cause the epidemic 
outbreak in a new city. When a rumor arises in the blogspace, 
its origin can be the popular and eloquent bloggers. When 
a network of water pipes is polluted by microorganisms or 
chemical substances, only the key points need to be examined 



to identify the pollution source. When the cyberspace is hit by 
junk mails or computer viruses, most of the victims should not 
be suspected as the culprit. Therefore, we do not necessarily 
treat every infected node as possible rumor source when 
identifying the source. Hereafter, we call the nodes that have 
the potential to initiate a rumor spreading process across a 
network as suspect nodes. 

In this paper, we consider the issue of identifying a ru- 
mor source from suspect nodes, conditioned on a snapshot 
observation of infected nodes in a network. Our goal is to 
identify the rumor source, only based on the knowledge of 
network structure, the set of suspect nodes and the observation 
of infected nodes. 



A. Related Works 

Over the past decades, abundant works have dealt with 
the problems on epidemic outbreaks across networks. The 
main attention has been paid to understanding the impacts 
of network structure and infection/cure rates on the diffusion 
processes, such as in J6|, Q, O, (9], iflOll . Besides, many 
researchers have developed network inference techniques to 
learn the underlying network parameters and predict the prop- 
agation characteristics, such as in IfTTI . Ifl2l . fOl . Ifl4ll . In 
addition, the issue of extracting the influential source nodes 
for epidemic spreadings has also been considered, such as in 
|4|, [15], |16|. Recently, the rumor source estimation problem 
has been formulated and studied for the first time. 

The pioneering work, which tackled the estimation problem 
of a single rumor source using the susceptible-infectious (SI) 
model in JTJ, (2), has led to an upsurge of the topic on 
rumor source estimation. For regular free-type networks, they 
constructed a maximum likelihood (ML) estimator and derived 
its asymptotic performance. When the node degree 6-2, i.e., 
for a line graph, the asymptotic correct detection probability 
is zero; when 5 = 3, it is 0.25; when 6 > 3, it is a 
positive constant value (pi(6), which approaches 0.307 as 5 
grows large. Besides, other types of networks and models 
are also considered, such as geometric trees [1], random 
graphs IfTTll . estimation of multiple rumor sources [18| and 
the susceptible-infectious-recovered (SIR) model [19|, and 
estimation of a single rumor source using sparsely distributed 
monitors' measurements ||20ll . However, those works assume 
that every node in the network has the potential to initiate the 
rumor spreading process. 
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B. Our Contributions 

In this paper, we treat the estimation problem of a single 
rumor source, with the a priori knowledge that the rumor 
source is restricted in a specified suspect set S of suspect 
nodes in a network G. The rumor spreading process across 
the network G is modeled by the SI model, which is a variant 
of the common SIR model for rumor spreading [5J- Here, 
it is reasonable to use the SI model, since we do not have 
much side information about the states of recovered nodes 
111. Conditioned on an observation of n infected nodes in 
the network G, we construct a maximum a posteriori (MAP) 
estimator to identify the rumor source. In order to study 
the performance of the estimator, we further analyze P c («), 
the correct detection probability upon observing n infected 
nodes. For regular tree-type networks with node degree 5, 
we establish exact and asymptotic detection results on P c («) 
under three interesting scenarios, assuming a uniform a priori 
distribution of the rumor source over S . The analysis leverages 
ideas from the Polya's urn model [21] and sheds insight into 
the behavior of the rumor spreading process. 

First, in the extreme case where S contains all nodes in 
the network G, i.e., every infected node has the potential to 
be the rumor source, our estimator reduces to that in (TJ, 
(2). However, different from |Q~), 0, we obtain the same 
asymptotic detection results on P c (n) as well. We conduct 
the argument via a rather different approach from theirs, 
only relying upon the discrete and limiting distribution of the 
number of infected nodes. By contrary, the authors in (TJ, 
conduct the argument explicitly relying upon the exponential 
distribution of the infection time. Besides, we also obtain exact 
detection results on P c (n) when the node degree 5-2 and 
<5 = 3, and our approach can be also used in the following 
cases. 

Second, in the case where S with cardinality k forms a 
connected subgraph of the network G, which may correspond 
to a small social community. When the node degree 5-2 and 
5 = 3, we can obtain both exact and asymptotic detection re- 
sults on P c (n). When 5 > 3, the asymptotic value lim„^ M P c («) 
is a positive constant value <p2(5,k) for all k <K n. Besides, 
P c (n) significantly exceeds the a priori probability 1 jk if the 
network is not linear (with 5 > 3), and the MAP estimator 
achieves reliable detection, i.e., lim,,-^ P c («) — * 1, as S grows 
sufficiently large. 

Third, in the case where S contains only two suspect nodes 
separated by their shortest path distance d, which may be a 
quantitative measure of the social closeness between them. 
Without loss of generality, consider d < n. For a line graph, 
we obtain exact detection results for P c («); when 5-3, 
lim„_ M P c (n) = 0.75 if d = 1 and lim, MOO P c («) * 0.886 if 
d - 2; when 5 > 3, lim^oo P c (n) is also a positive constant 
value <pi(5) > 0.75 if d = 1, which further approaches one as 
5 grows sufficiently large. In addition, P c («) increases with d 
for general regular trees. 

C. Organizations 

First, Section II describes the framework of the SI rumor 
spreading model and the MAP estimator to identify the rumor 



source. Second, we establish theoretical results on the detec- 
tion probability of the estimator for regular tree-type networks 
under three scenarios with the Polyas urn model in Section 
III. Third, we carry out simulation experiments to study the 
detection performance of the estimator for regular trees in 
Section IV. At last, we conclude the paper in Section V. 

II. Rumor Spreading Model and Rumor Source Estimator 

In this section, we describe the SI rumor spreading model, 
define the MAP rumor source estimator for regular trees, and 
introduce the concept of local rumor center. 

A. Rumor Spreading Model 

In general, a undirected network G = (V, E) consists of a 
set of nodes V and a set of edges E. V is assumed countably 
infinite so as to avoid any boundary effect, and any pair of 
nodes may infect each other if and only if they are connected 
by an edge in E. The network is assumed static, without nodes 
joining or leaving. 

In this paper, the rumor spreading process is modeled by 
the susceptible-infectious (SI) model, a variant of the com- 
mon susceptible-infectious-recovered (SIR) model for rumor 
spreading. In the SI model, it is assumed that the system 
operates in a progressive fashion, i.e., once a node gets infected 
it keeps the rumor forever. 

We consider the case that only a single node in an a 
priori specified suspect set S can be the rumor source in 
each resulting infection across the network G, where S = 
{s\,S2,--- ,Sk} c V has cardinality k. We assume a priori 
distribution P s of the rumor source over the nodes in S, and 
thus P s (s) denotes the probability that s e S initiates a rumor 
spreading process. For normalization, we have 

k 

2 P »(*) = 1 - 

!=1 

In the following, we call the nodes in S as suspect nodes and 
assume a uniform a priori distribution P s over the nodes in 
S , i.e., P s (s) = I Ik for any s e S . 

The rumor spreading process unfolds as follows. Initially, 
only a single node s* e S possesses a rumor to spread over 
the network G, and thus is termed infected. An infected node 
may infect its neighbors, independent of all other nodes. Let 
Tjj be the time it takes for node j to receive the rumor from its 
neighbor i after i has the rumor, where (/, j) e E. In this model, 
we suppose that fry, (i, j) e E) are mutually independent 
and all exponentially distributed with rate A. Without loss of 
generality, we assume A = 1. 

B. Rumor Source Estimator: Maximum a Posteriori (MAP) 
(1) MAP estimator 

Suppose that a rumor originates from a node s* e S, and 
we get to observe the network G at some point in time and 
find a snapshot of n infected nodes carrying the rumor, which 
are collectively denoted by G„. Due to the SI model, G„ must 
form a connected subgraph of G and contain at least a node 
in S, that is the rumor source. Our goal is to construct an 
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Fig. 1. Illustration of subtree T' u . 



estimator to identify a node s as the estimate of the rumor 
source s*. 

Now, conditioned on G„, the source node has a uniform 
distribution over the nodes in S f] G n to initiate the infection. 
Utilizing the Bayes rule, the maximum a posteriori (MAP) 
estimator of s* that maximizes the correct detection probability 
is 

s e argmaxP G (s|G„) 

P G (G n \s)P & (s) 

= arg max 



arg max P G (G„\s), 



(2) 



where Pq(G„\s) is the probability of observing G„, assuming 
s to be the rumor source. Note that a key difference from the 
model in (T) is that here we restrict the rumor source to be 
within the a priori suspect set S c V. Naturally, we would 
first evaluate Pq (G„\s) for all jejSH G n ) and then pick the 
one with the maximal value as the estimate s. 
(2) Optimal MAP estimator for regular trees 
In general, the evaluation of Pq (G„\s) may be computation- 
ally prohibitive since it is related to counting the number of 
linear extensions of a partially ordered set (T), 1221 . Therefore, 
we leverage the concept of rumor centrality, first developed in 
lHJ, to design our estimator using only O(n) computations. 

Similar to the analysis in [U, the optimal MAP estimator 
for a regular tree can be derived as 

s e arg max Pq (G„\s) = arg max R (s, G„), (3) 

>£{iflC„l KlSflCI 

where R(s,G„) is the rumor centrality of node s in G„ and can 
be computed by 



(4) 



where is the subtree rooted at node u with node s as the 
source in G„ and 7** is the number of nodes in JJ; e.g., see 
Fig. 1. 

(3) Approximate estimator for general trees and graphs 
For general trees, the estimator (|3]l with the rumor central- 
ity is also applicable though heuristic. So, the approximate 
estimator becomes 



Besides, a message-passing algorithm is proposed in JT] to 
compute rumor centralities for all nodes in a general tree G„ 
with n nodes, using only O(ri) computations. 

For general graphs without a tree structure, we can not 
directly use the estimator Q with the rumor centrality. With 
the intuition that the rumor generally travels from the source to 
each infected node along a minimum-distance path |1|, |20|, 
we construct a breadth-first search (BFS) tree as the diffusion 
tree at first. So, the approximate estimator becomes 



s e arg max R (s, T^f^(s)\ 

■5e(Snc„l 



(6) 



where 7\,f s (s) is the BFS tree that begins with node s as the 
source in a general graph G„ with n nodes. In total, at most 
0(n 3 ) computations are used. 



C. Local Rumor Center on General Trees 

The rumor centrality is an important quantity of graph score, 
reflecting many interesting properties of network structure, 
such as explicit succinct representation, definite relation be- 
tween neighboring nodes, equivalence to distance centrality 
on general trees; see the details in (TJ. 

Next, we develop a concept of local rumor center related to 
the rumor centrality, which enables efficient implementation 
of the estimator ([3) and furthermore will be instrumental for 
our subsequent analysis. A useful fact from |[T] is that the 
following relationship holds for any two neighboring nodes u 
and s in a tree G„: 



R(u,G„) = R(s,G„) 



n - \t: 



(7) 



s e arg max R (s, G„). 



(5) 



Now, consider a node s with a neighbor set N(s) and a 
sub-neighborhood N,(s) c N(s). If R(s, G„) > R(u,G„) for all 
// e N/(s), then s is called the local rumor center with respect 
to (w.r.t.) the sub-neighborhood Ni(s) of G„. For local rumor 
center, we have the following proposition. 

Proposition 1. i) Given a tree G n of n node, if node s* is 
the local rumor center w.r.t. a sub-neighborhood Ni(s*) C G„, 
then for any u € N[(s*), we have |jj | < n/2; and for any 
u' € T,f \ {u\, we have R(u',G n ) < R(s*,G„). 
ii) If there is a node s* such that |7^*| < n/2 for all u € Ni(s*), 
then s" is a local rumor center w.r.t. the sub-neighborhood 
Ni(s*) c G„. 

Hi) Furthermore, if node s* is the local rumor center w.r.t. a 
sub-neighborhood Nj(s*) C G„, then there is at most a node 
u e Ni(s*) such that R(u,G n ) — R(s*,G„), which holds if and 
only if\T*'\ = n/2. 

Remark 1: In fact, the local rumor center is a generalization 
of the rumor center in fT|, which is the node with the maximal 
rumor centrality in G„. When Ni(s) = N(s), the two are the 
same. However, the rumor center may belong to the set G„ \ 
S and thus is not the solution of the estimator {3). Besides, 
notice that we can find at most two local rumor centers from 
a connected suspect set S w.r.t. the sub-neighborhood formed 
by S, given a snapshot infection G„. 
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Proof of Proposition 1. First of all, consider u e Ni(s*), 
(|7) we have 

R(u,g„) = [r,fl 

G„) n-lrrl" 



by 



(8) 



Since R(u,G n ) < R(s*,G„), thus \T^ \ < n/2. 

Then consider u' e \ {w}, and let V(u, u') be the set of 
nodes along the shortest path from u and u' , not including m. 
Repeatedly using Q, we have 



R(u' , G„) 
R(u,G„) 



- n 

\'ef(w,w') 







5* 











(9) 



As we have already known that fT* < n/2, thus | < lT* < 
n/2, i.e. |r,?*|/(n - |r,f |) < 1 for all v e V(u,u'). Therefore, 
R(u',G„) < R(u,G n ) < R(s*,G n ). This proves the first part of 
Proposition 1. 

Now for the second part of Proposition 1, if \T S U | < n/2, i.e. 

\ T u\li n ~ \ T u\) ^ 1 for a11 " 6 N,(s*), then by ^ we see that 
R(u,G n ) < R(s*,G n ). Therefore, s* is the local rumor center 
w.r.t. its sub-neighborhood Ni(s*) c G n . 

As for the third part of Proposition 1, if there is a node 
u € Ni(s*) such that R(u,G n ) = R(s*,G n ), then by ^ we 
see that |r„*| = n/2; the deducing process holds backward. 
Besides, there can be at most a subtree r,f (u € Ni(s*)) such 
that \T*'\ = n/2, since the total number of nodes in G„ is n and 
any two subtrees with s* as the source are disjoint. As a result, 
if node s* is the local rumor center w.r.t. a sub-neighborhood 
N/(s*) c G„ and there has already been a node u* e Ni(s*) 
such that R(u*,G„) = R(s*,G„), then for all u e N,(s*) \ {«*} 
we have \t£\ < n/2, i.e. \t£\ /(n - \T*"\) < 1. Again, by ((SJ 
we have R(u,G n ) < R(s*,G„). □ 

III. Detection Probability on Regular Trees 

In this section, we analyze the performance of the MAP 
rumor source estimator for regular tree-type networks. Three 
interesting scenarios are analyzed: First, when the suspect 
set contains all nodes in the network, the best detection 
probability is 0.307 without any a priori knowledge. Second, 
when the suspect set forms a small connected subgraph of the 
network, reliable detection can be achieved. Third, when the 
suspect set contains only two nodes, the detection probability 
increases with their separation distance. We show that the 
rumor spreading process on regular trees is equivalent to the 
ball drawing process of the Polya's urn model, and utilize its 
well-known distribution to establish the performance of the 
MAP estimator. In the following, we start by introducing our 
main results and the preliminaries on the Polya's urn model. 

A. Main Results 

We focus on the correct detection probability P c (n), the 
probability of the estimator to correctly identify the rumor 
source from the suspect set S , upon observing G„ of n infected 
nodes across the network G = (V, E). For a regular tree with 
node degree 6, we can use numerical computation to calculate 
P c (n) as n is small. Besides, we have the following three 
theorems for P c (n). 



x, infected nodes x ^ infected nodes 

< = > 




x 1 infected nodes 



Fig. 2. Illustration of X\ = X\, Xi = X2, X3 = X3 infected nodes in subtrees 
Tf { , T* 2 and TL with s* as the source across a regular tree G with node 
degree 5 = 3, respectively. 

(1) Suspecting all nodes 

In the extreme case of S = V, every infected node in an 
observation G n has the potential to be the rumor source, i.e. 
without any a priori knowledge. Assuming a node s* to be the 
rumor source, we could observe Xj = Xj (1 < j < 8) infected 
nodes in each subtree T* rooted at node V; with node s* as 
the source in G„, where Xj is a random variable; e.g., see Fig. 
2. Then, we will establish the following theorem. 

Theorem 2. Suppose S — V, i.e., every infected node is a 

suspect node, then: 

i) When 6 — 2 (line graph), 



Pc(b) -2->(l(h-1)W 
and P c (n) = 0(1/ yfn) with sufficiently large n. 
ii) When 6-3, 

Pe(»)^ + 3 1 



(10) 



(11) 



4 4 2|n/2J + l 
and P c (n) = 0.25 +<9(l/n) with sufficiently large n. 
Hi) When 6 > 3, 

n UmP c (n)=0 1 (^:=l-<5|l-/ 1/2 |^,^U, (12) 

where I x (a,f3) is the regularized incomplete Beta function with 
parameters a and B; and (f>i(6) — 1 — In 2 « 0.307 as 6 grows 
sufficiently large. 

Remark 2: With S = V, the estimator (B) in fact reduces 
to the ML estimator established in JT|, j2ijTH The asymptotic 
parts of Theorem 1 have been established in 0], J2] via a 
rather different approach from ours, explicitly relying upon 
the exponential distribution of the infection time. We see 
that without any a priori knowledge, the estimator achieves 
nontrivial detection probability if the network is not linear, 
but the asymptotic detection probability is upper bounded by 
0.307. 

(2) Connected suspects 

'Strictly speaking, our setup of uniform a priori distribution of the rumor 
source over S is not well defined when S = V since it is a countably infinite 
set. Our remedy is that we consider ML estimation for Theorem 2 thus 
returning to the situation in (T], 0, and consider MAP estimation for the 
other two cases. 
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In the case where S = {si, S2, ■ ■ ■ , Vk) with cardinality k 
forms a connected subgraph of the network G; e.g., see Fig. 3. 
With this a priori knowledge, we will establish the following 
theorem. 

Theorem 3. Suppose that S forms a connected subgraph of 
G, and assume \S \ — k <K n, then: 
i) When 5 — 2 (line graph), 



11 k - I ( n-l 
PM =k 1+ 2^L-D/2J 



and P c (n) = l/k + 0(1/ V") with sufficiently large n. 
ii) When 6-3, 

k+1 k-\ 1 
Pc(") = -=z- + 



(13) 



2k k 4L«/2J + 2 ' 



(14) 



and P c (n) — (k + l)/(2k) + 0(l/n) with sufficiently large n. 
Hi) When 6 > 3, 



lim P„(«) = 4> 2 (6,k) := 1 - 



2k -2 



1 -/ 



1/2 



1 6-1 



6-T 6-2 



(15) 



and $2(6, k) — 1 as 6 grows sufficiently large. 



Remark 3: For line graphs, P c («) can barely exceed the a 
priori probability l/k. When 6 > 3, lim^oo P c («) > l/k + 
(k - I) /(2k) > l/k for all k <sc n. Furthermore, the MAP 
estimator achieves reliable detection as 6 grows sufficiently 
large. Therefore, we see that the performance of the MAP 
estimator is significantly improved and reliable detection can 
be achieved, only given the a priori knowledge on a small 
connected subgraph composed by the suspect nodes. 

(3) Two suspects 

In the case where S contains only two suspect nodes s t and 
52, denote by d their shortest path distance on the network G; 
e.g., see Fig. 4. Since we can ensure correct estimation of 
the source if d > n, we assume d < n. With this a priori 
knowledge, we have the following theorem. 

Theorem 4. Suppose S only contains two suspect nodes, and 
denote by d their shortest path distance (d < n), then: 



i) When 6 — 2 (line graph). 

(n+d+\)l2 



Pc(») = 



1 1 

2 ~ 2 



- ^ j J, (n — d) is odd; 



--(n-d-l)ll 

2 2" ^ 



1 1 v~i In — \ 



2 2" ' \ zi 

z 1 =(«-^)/2 V 1 



(16) 



, (n — d) is even. 



ii) When 6 = 3, 



lim P c (n) < 



0.75, d=\, 
0.886, d = 2. 



(17) 



Hi) When 6 > 3, 



lim P cl ;,) = :=/, 2 |-^-L </ = |. (18) 



and 4>i(6) = 1 as 6 grows sufficiently large, 
iv) In general P c (n) increases with d. 

Remark 4: It is harder to correctly identify the rumor source 
if the two suspect nodes are closer, i.e. with stronger social 
strength, to each other; and vice versa. Besides, the a priori 
probability of 1/2 can be also significantly exceeded when 
6 > 3. Furthermore, the MAP estimator also achieves reliable 
detection whenever 6 grows sufficiently large. 



B. Equivalence to the Polya's Urn Model 
(1) Preliminaries 

Before the argument of the theorems above, we introduce 
the preliminaries on the Polya's urn model, then we will show 
that the rumor spreading process on regular trees is equivalent 
to the ball drawing process of the Polya's urn model, a fact 
first noticed and utilized in |2|. This allows the exact detection 
probability to be explicitly established. 

Polya's urn model f ED . Chapter 4): initially, the urn 
contains bj balls of color Cj (1 < j < 6); at each uniform 
drawing of a single ball, the ball is returned together with s 
balls of the same color; after n draws, the number Xj is the 
number of times that the balls of color C,- are drawn. Then 




Fig. 3. Illustration of a suspect set S = {si, *2, ...,.99} with multiple connected 
suspect nodes across a regular tree G with node degree 5 = 3. The nodes in 
S form a connected subgraph of G. 



Fig. 4. Illustration of two suspect nodes with distance d on a regular tree G 
with node degree S = 3. There are d nodes from si to 12 except Si, which 
are sequentially notated as Vi , V2, . . . , Vd-l , Vd = $2- 
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the joint distribution of {Xj, 1 < j < 6} can be derived as 



7=1 



U% 1 bj(bj + s)---(bj + (x j -l)s) 



■Xgl 



b(b + s) ■ ■ ■ (b + (n - l)s) 



(19) 



where b = Y*j=\bj and Yij=\ x j = n - l n f act > it is a 5 - 1 
dimensional distribution. 

As n — > oo, the limiting joint distribution of the ratios 
[Xj/n, 1 < j < 5} converges to the Dirichlet distribution with 
a density function given by 



lim P G 



IXor) 



(20) 



where = fcy/s, a = Yfj=\ a j an d £7=1 yj - 1- Here, r(a) is 
the gamma function with parameter a. 
Besides, the marginal distribution of X\ is 



Pg (Xi = jci) = 



n! n- =1 ^ + *)- 



r' ' r' ' 



(21) 



fr(Z? + s) ■■■(b + (n - l)s) 

where b\ =b\, b' 2 - b - b\, x\ = and xi - n — x\. In fact, 
it can be seen as a special case of the Polya's urn model with 
two colors. 

As n — > oo, the limiting marginal distribution of the ratio 
X\ In converges to the Beta distribution with a density function 
given by 

(X\ \ rXor'j + aQ 



lim P, 



-Ji ( J 



(22) 



r(a[)r(a' 2 ) 

where a\ — ct\ and a' 2 = a — a\. The cumulative distribution 
function of the Beta distribution is 
T(a\ + aQ 
Wc 



I x (a\,a' z ) :- 



\a\ + a') C x , . 
(a\)Y(a' 2 ) Jo y 



(23) 



for all x e [0,1]. l x {a! x , a' 2 ) is called as the regularized 
incomplete Beta function with parameters a' y and a' v 

In particular, we are interested in l\j2{a' v a l 2 ) with parame- 
ters a'j = 1/(6 — 2) and a' 2 = (6 - l)/(6 - 2), where 6 is the 
node degree of a regular tree and 6 > 3; e.g., see Fig. 5. 

(2) Equivalence to the Polya's urn model 

Next, we show that the rumor spreading process on regular 
trees is equivalent to the ball drawing process of the Polya's 
urn model, whose well-known distributions will be used in our 
subsequent analysis for Theorem 2 and Theorem 3. 

For a rumor source s* with 6 neighboring nodes vi, . . . , v$, 
let T* (1 < j < 6) be the subtree rooted at node Vj with node 
S* as the source in G„, and define a random variable Xj as 
the number of nodes in 7^.; e.g., see Fig. 2. In the rumor 
spreading process, nodes in G„ are infected sequentially, and 
thus we have the following: initially, s* has one neighbor in 
each subtree T'. (1 < j < 6) that can be potentially infected; 
after one of those nodes is infected, it introduces 6-1 new 
potentially susceptible nodes; finally, n — 1 nodes are infected 
besides s*. Due to the memoryless and i.i.d. properties of 
exponentially distributed infection times {jij,(i,j) e E], in 
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Fig. 5. The regularized incomplete Beta function 7i/2(l/(i5-2), (S— 1)/(<5-2)) 
vs. node degree S. 



each step, the infected node is uniformly selected from the 
susceptible nodes. 

Now, the resulting infection G n with Xj nodes in T'. (1 < 
j < 6) can be constructed in an equivalent way by the Polya's 
urn model ET1 Chapter 4]: initially, the urn has one ball for 
each color Cj\ at each uniform drawing of a single ball, the 
ball is returned together with s = 6 - 2 additional balls of the 
same color; after n—1 draws, Xj is the number of times that 
the balls of color C,- are drawn. 

Therefore, in the rumor spreading process, if we assume 
s* to be the rumor source with 6 neighbors V\ , x>2, ■ ■ ■ , Vg and 
observe n infected nodes G„ with Xj nodes in each subtree 
Tf. (1 < j < 6), then by (|T9j the joint distribution of {Xj, 1 < 
j < 6} can be derived as 



7=1 



Xj) 



(n-iy. n- = i Kl +*)■•■(! +(*/-!)*) 



■x 5 \ 



6(6+ s) • • -(6 + (n- 2)s) 



(24) 



where Yfj=\ Xj-n-1. 

We are also interested in the limiting marginal distribution 
of the ratio X\/n as n —> oo. By (|22]), we have 



limP G (^=y) 



■yf-\ 



(25) 



r(aW 

where a = 1/(6-2), = (6-1)1(6-2). By the way, this limit 
distribution is also used in to derive the asymptotic correct 
detection probability in the case S - V with 6 > 3. 
(3) Markov concatenation of the Polya's urn model 
For Theorem 4, we use the Markov concatenation of the 
Polya's urn model to derive the probability distribution of the 
infection observed in the rumor spreading process, focusing 
on the nodes along the path from si and S2- 

Assume Sj to be the rumor source s*, and let P = {vo = 
Si,vi,--' ,Vd - S2} be the shortest path from s\ to S2; e.g., 
see Fig. 4. Here, let a random variable Z/, (1 < h < d) be 



7 



the number of nodes in subtree T£ rooted at node v/, with 
node s* as the source in G„. It is clear that Z/, > Z/, + i + 1 if 
Zf, > for all 1 < h < d — 1. In the proof of Theorem 4, 
we focus on the error detection probability P e (n) = 1 - P c (n). 
Therefore, without loss of generality we assume Z/, > for all 
1 < h < d. Here, we can also construct the random variables 
Z/, (1 < h < d) equivalently with the concatenation use of the 
Polya's urn model. 

For random variable Z\, we construct it by the Polya's urn 
model as follows: initially, the urn has bl = 1 black ball and 
b\, = 8 — 1 white balls; at each uniform drawing of a single 
ball, the ball is returned together with s — 8 - 2 additional 
balls of the same color; after n - 1 draws, the number Z\ is 
the number of times that the balls of black color are drawn. 
Therefore, by ([19} the distribution of Z\ is 



Remark 5: Lemma 5 is deduced from Proposition 1. In 
order to prove Theorem 2 (and Theorem 3), we should find 
the conditions, under which s* is the local rumor center w.r.t. 
Ni(s*) of G n , such that the estimator ([3} can correctly identify 
s* as the source. 

Here, S — V, thus source s* has m = 8 neighboring suspect 
nodes. By Lemma 5, we can write P c (n) as 



Pew = pi/2- 2 Pc n ,x; - V;) 

maxj.v j,l<j<6}=n/2 L j= 1 



+Pl ■ 2 P G 0^ = *j> 

max(.Vj,l<;<<5)<n/2 L./=l 



(30) 



i n _l\bl---(bl + (z 



Pg [Zi = zil = 

-\)s)b\ v ---(b\ v 



+ (n-zi- 2)s) 



8(8 + s)---(8 + (n- 2)s) 



(26) 



For random variable Z/, (2 < h < d) conditioned on Z/,_i 
we construct it by the Polya's urn model as follows: 
initially, the urn has b h b -\ black ball and b h w -5-2 white 
balls; at each uniform drawing of a single ball, the ball is 
returned together with s — 5 - 2 additional balls of the same 
color; after Zh-i - 1 draws, the number Z/, is the number of 
times that the balls of black color are drawn. Again, by ([19} 
the distribution of Z/, is 



where Pg [nf=i(-^/ = x j)\ is the probability of observing n 
infected nodes G„ with Xj = Xj nodes in subtree T*. for all 

1 < j < 8 on a regular tree with node degree 6; see its closed- 
form expression in |24}. Notice that Tf — for all 1 < j < 8. 

As n is small, we can make use of numerical computation 
to calculate the correct detection probability P c («) with ( [30} . 
In the following, we will establish the argument of Theorem 

2 under three situations when the node degree 6 = 2, 5 — 3 
and 8 > 3, respectively. 

(1) Detection probability when 8-2 

Proof of Theorem 2-i. When 8-2, the distribution in ([24} 
can be written as 



lzi,-i - 

\ Zh 



l\b h h 



Pg [Zh = Zh\Zh-\ - Zh-i] = 
■ (ft* + (zh ~ mbt ■ ■ ■ (bi + (z h -i - z h - 2)s) 



(8 - \)(8 - \ + s)- ■ - (8 - \ + (z h -x - 2)s) 

Since Z/, only depends on Z^_\ for all 2 < h < d, thus 
Z\ , Z2, . . . , Zj form a Markov chain. Therefore, by the Markov 
chain rule the joint distribution of {Z/,, 1 < h < d) is 

d 

P G f](Z h = z h ) 



(27) 



/=1 



(n-iy. 1 



(31) 



h=\ 



By ( [30} , the correct detection probability is 

2 

Pc(«) = Pi/2- Pg 



P G [Zi = zi] ]~ [ P G [Z A = za|Z a _j = Zh-i] ■ 



(28) 



2 



7=1 



A=2 



C. Proof of Theorem 2: Suspecting all Nodes 

In the case of S = V, we only need to consider an arbitrary 
node s* € G as the rumor source by symmetry. For a source 
s* with m (m < 8) neighboring nodes Ni(s*) = {**,..., s^} c 
S , let a random variable Xj be the number of nodes in each 

subtree T s ", (1 < j < m) of G„. Then, we have the following 

■ j 

lemma for the argument of Theorem 2 (m — 8) and Theorem 
3 (m < 8); see its proof in Appendix-A. 

Lemma 5. To correctly identify source s* with m neighboring 
suspect nodes as the estimate s, we have 



max(A"i ,X2}= n/2 

+Pi- Yj Pg 

max{xi ,x2\<n!2 

ll n-l 
2^i(l("-1)/2J, 

Above, the detailed deduction is in Appendix-B. 
As n — > 00, by the Stirling's formula we have 



(32) 



P c (n) 



1 

2" 
1 

2" 



[(«/2)!] 2 



(ie) 



nil 



P\ 



maxjxy, 1 < j < m] < 



n/2) 



1, 



P1/2 ■= Pc h = max{x j5 1 < j < m} = n/2^j = i, 
/?o := Pc ^ = s* maxfjCj, 1 < j < m} > n/2j = 0. 



(29) 



(2) Detection probability when 5 = 3 



(33) 
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Proof of Theorem 2-ii. When 6 
can be written as 

3 



3, the distribution in (124b as n — > oo 



./=! 



n{n + 1) 



(34) 



By ((301 
Pc(») = 



the correct detection probability is 

3 



Pi/2 ■ 



z 



max(.v /5 l< j<3}=n/2 

+Pi ■ 2 Pg 

max(.Vy,l<j<3)<n/2 
1 



o 

7=1 



7=1 



1 3 
4 + 4 2L«/2J + 1' 
Above, the detailed deduction is in Appendix-C. 



(35) 



(3) Detection probability when 6 > 3 

As « is small, we can make use of numerical computation to 
calculate the correct detection probability with ( |3"0"| l. As n — > 
oo, we derive the asymptomatic correct detection probability 
in a similar way as that in Q. 

Before the argument of Theorem 2-iii, we present the 
following lemma, which will be also used in the argument 
of Theorem 3-iii; see its proof in Appendix-D. For a source 
s* with m (m < 6) neighboring nodes Ni(s*) = {s*, ... , s* n ) in 
S , let a random variable Xj be the number of nodes in each 

subtree T s , (1 < j < m) of G„. 

j 

Lemma 6. Define Ej = {Xj < n/2] and Fj = {Xj < n/2), 
1 < j < m. To correctly identify source s* with m neighboring 
suspect nodes, we have 



P c (n|j') > 1 - mY> G (E\) 
P c (n|i*) < 1 - mP G (FD 



(36) 



where Pg(£'[) and Pg(^j) are the probabilities that the 
complements of events E\ and F\ occur, respectively. 

Remark 6: Lemma 6 is deduced from Proposition 1, and is 
a generalization of the statement claimed in |2, Section 4.1.2]. 
In order to prove Theorem 2-iii (and Theorem 3-iii), we should 
show that the lower and upper bounds asymptotically coincide. 

Proof of Theorem 2-iii. Since E\ — {X\ < n/2) and F\ 

X < n/2}, i.e., E x = {X x /n < 1/2} and Fj = {XJn < 1/2), 
we consider the cumulative distribution function of the ratio 
r, see the expression in (|25|>. Then, 



X\ /n as n — 
limPcCE!) = 



lim P G (Fi) 

11— ioo 

£ 2 r(a+JT> 



y 



ly=0 r(a)T(J3) 
,1 S-l 

h/2 



Hi-yf-'dy 



Besides, we see that the asymptotic value lim^oo P c (n) > 
0.25 if the node degree 5 > 3. Furthermore, it approaches 
1 - ln2 * 0.307 as 6 oo. □ 

D. Proof of Theorem 3: Connected Suspects 

Now, consider the case where S = {s\, S2, ■ ■ ■ , v^} with 
cardinality k forms a connected subgraph of the network G. By 
the Bayes rule and the a priori knowledge that P s (s*) = l/k 
for any s* € S , we have 

P c («) = P s (s,)Pc(»k,) = - ?c(n\s*). (39) 

;=1 s'es 

Therefore, we should first find the correct detection probability 
P c («|s*) for each suspect node s* e 5. 

Assume that s* € S is the rumor source and it has m (m < 5) 
neighboring suspect nodes N/{s*) = {s^, . . . , s* m } c S. Let a 
random variable Xj be the number of nodes in each subtree 
T s s l (1 < j < m) of G n , then by Lemma 5, we should find the 
conditions that s* is the local rumor center w.r.t. Ni(s*) of G„ 
and the estimator ^ can correctly identify s* as the source. 

By Lemma 5, we can write P c (n|s*) as 



PJn\s*) = 



Pl/2 ■ Yj Pg 

maxjj:y,l< j<m}=n/2 

+pi ■ Y Pg 

max(Aj,l< j<m}<n/2 



s 



7=1 



,(40) 



where Pg [H^iCO - x j)\ i s the probability of observing n 



infected nodes G„ with X: 



nodes in subtree T„, for all 



*-j ~ 

1 < j < 6 on a regular tree with node degree 6; see its closed- 
form expression in ((24]). Notice that Tf, - T*l for all 1 < j < 
m. 

As n is small, we can make use of numerical computation 
to calculate the correct detection probability P c («) with ((39]) 
and ( |40| ). In the following, we will establish the argument of 
Theorem 3 under three situations when the node degree 5-2, 
6 = 3 and S > 3, respectively. 

(1) Detection probability when 6 = 2 



Proof of Theorem 3-i. When 6 
can be written as 

2 

Pg' 



7=1 



Xj) 



2, the distribution in d24l 



(n-1)! 1 



(41) 



By ( |40| >, the correct detection probability for a suspect node 
s* with m neighbors in the suspect set S is 

2 



(37) 



[6-2 6-2 

where I x (a,/3) is the regularized incomplete Beta function with 
parameters a — 1/6 and /3 = {6 - l)/(6 - 2). 

Since S — V, the source s* has m — 5 neighboring suspect 
nodes. By Lemma 6, the correct detection probability is 

*«(»)= i-*(i-W^.f^)). ^ 



PcCbIO = Pi/2- Pg 

max(x ; -,l<y<m(=«/2 

+Pi ■ 2 Pg 

max{j: / ,l< i / , </7i|<;j/2 

1 1 / n- 1 

2 + 2f\(n - l)/2j 
1 / n-1 

Yin - 1)/2J 



7=1 



Xj) 
Xj) 



7=1 



2. 



(42) 
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Above, the detailed deduction is in Appendix-E. 

Now for suspect set S = {si, S2, . . ■ , Vj} with cardinality k, 
which forms a connected subgraph of a line graph G, i.e., a 
sub-line graph, we know that only the two suspect nodes at the 
endpoints of the sub-line graph have one neighboring suspect 
node and all other suspect nodes have two neighboring suspect 
nodes. Therefore, by ([39} we have 



P c (n) 



1 + 



k-l 



1 



2"- 1 \L(«-D/2J 

As n — > 00, by the same method used in ( |33| > we have 

1 ,,, 1 
k 



Pc(«) 



1 k- 

- + 

k k 



yn 



■O(-). 
yn 



(43) 



(44) 



(2) Detection probability when 6 = 3 

Proof of Theorem 3-ii. When 6 = 3, the distribution in ([23] 
can be written as 



= xj) 

7=1 



n(n + 1) 



(45) 



By ( |40| ), the correct detection probability for a suspect node 
s* with m neighbors in the suspect set S is 



P e (n\s*) = pi/2 ■ 



max ( x j 1 , 1 < j< m }=/i/2 



7=1 



max{.vy,l<y<m}<w/2 L /=1 

1 1 

i ,m = 1; 

4 2L«/2J + 1 



x ; ) 



4 
1 

2 + ^ 
1 



2 2L«/2J + 1 

3 1 



, m — 2; 



(46) 



■ 4 2L«/2J + 1 

Above, the detailed deduction is in Appendix-F. 

Now for suspect set S with cardinality k, which forms a 
connected subgraph of a regular tree G with node degree 6 = 3, 
for each suspect node s* e S we should first see the number 
of its neighboring suspect nodes. Notice that, given s* with m 
neighboring suspect nodes, P c (n|s*) is one reduced by a same 
factor, 1/4- 1/(8|_«/2J +4), m times, each of which accounts 
for one neighboring suspect node of s* connected by an edge. 
Since there are k-l edges connecting the k suspect nodes of 
S in the network G, each edge will account for a reduction of 
the factor twice. Therefore, by ([39} we have 



P c (n) 



1-1 

k 

k + i 

2k 



2(k-l) 
k- 1 



1 



8L«/2J +4 



k 4L«/2J + 2 



(47) 



(3) Detection probability when 6 > 3 

As n is small, we can make use of numerical computation to 
calculate the correct detection probability with ([39} and ( [40} . 
As n — > 00, we can derive the asymptotic correct detection 



probability with Lemma 6 and an insight analysis into the 
graph structure. 

Based on Lemma 6, we derive P c {n\s*) with its lower and 
upper bounds, which both asymptotically coincide as n — > 00, 
in order to prove Theorem 3-iii. 



Proof of Theorem 3-iii. When n — > 00, by ([37} we have 

1 6- 1\ 



limP G (£i)= lim P G CFi) = /i/2 



6-2' 6-2) 



(48) 



where I x (a,/3) is the regularized incomplete Beta function with 
parameters a and (3. 

By Lemma 6, the correct detection probability for a suspect 
node s* with m neighbors in the suspect set S is 



P c (»|s*)= 1-™ I-/1/2 



1 6- 1 



6-2' 5-2 ' 



(49) 



Now for suspect set S with cardinality k, which forms a 
connected subgraph of a regular tree G with node degree 6 > 3, 
for each suspect node s* e S we should first see the number of 
its neighboring suspect nodes. Notice that, lim^oo P c (n|s*) is 
one reduced by a same factor m times, each of which accounts 
for one neighboring suspect node of s* connected by an edge. 
Since there are k - 1 edges connecting the k suspect nodes of 
S in the network G, each edge will account for a reduction of 
the factor twice. Besides, after we reduce the factor by 2{k— 1) 
times in total, the limit characteristics in the factor still holds 
if k <sc n. Therefore, by ([39} we have 



P c (n) = 1- 



1 



2{k-V)- l-/i /2 



1 6-V 



l 2(k-l) | 2(k-l) J 



6-2' 6-2) 
1 6-V 



1/2 



6-2 6-2 



,(50) 



for all k <K n and n — > 00. 

From Fig. 5, we see that h/ii^pi, fEj) > 0.75 as the node 
degree 6 > 3. Therefore, we have 



Pc(«) > 



k+ 1 

2AT' 



for all k <K n, n — > 00 and 6 > 3. 

Besides, /1/2 (0, 1) = 1 (setting 6 — > 00). Therefore, 

Pc(») = 1, 



(51) 



(52) 



for all k <K n, n — > 00 and 6 — > 00. Importantly, note that the 
growth of 6 need not be dependent on the growth of n. □ 

E. Proof of Theorem 4: Two Suspects 

At last, in the case where S = {si,S2} contains only two 
suspect nodes, let d be the shortest path distance between S\ 
and S2 on the network G. We assume si to be the rumor 
source s* by symmetry, let V = {vo = si,vi,-- - ,vj = S2} be 
the shortest path from s\ to S2, and define random variables 
Z/, be the numbers of nodes in subtrees 7T (1 < h < d). It is 
clear that Z h > Z /l+1 + 1 if Z h > for all 1 < h < d- 1. 

In the following, we focus on the error detection probability, 
i.e., P e (n) = 1 - P c («). As a result, Z h > for all 1 < h < d. 
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Since there are only two suspect nodes in S, P e («) can be 
written as 

d 



P.(«) = 



z 
z 



«(s*,G„)=«(j 2 ,G„) 

Pg 



i 



Above, the detailed deduction is in Appendix-H. □ 

(3) Detection probability when 6 > 3 

Proof of Theorem 4-iii. Consider the case when d — 1 . By 
(|49|), the error detection probability is 



(53) 

«(i*,G„)<«(s 2 ,C„) L/i=l 

where PG[rift=i(^i = Za)1 ls the probability of observing n 
infected nodes G„ with Z/, = Zh nodes in subtree T' for all 
1 < h < d on a regular tree with node degree 6; see its closed- 
form expression in ( |28) l. 

As n is small, we can make use of numerical computation 
to calculate the error detection probability P e («) with ( f53] >. In 
the following, we will establish the argument of Theorem 4. 

(1) Detection probability when 5 = 2 

Proof of Theorem 4-i. By Q, we have R(s*,G„) = y~*j and 

R(s 2 ,Gn) = If R(s*, G„) < R(s 2 ,G„), then Zl > (n + rf + 

l)/2. Notice that we only need to consider the distribution of 
Z\ . When 5-2 the distribution in |26} can be written as 

(n-1)! 1 



P e (») = 1-Pc(») 



1 -/ 



1/2 



1 6-1 



5-2 8-2 



(59) 



Pg [Zi = zi] = 



Pe(«) 



Zi!(n-z, - l)!2»- r 
By ( f53] l, the error detection probability is 
1 

2 



z 



zi] + 2j Pg [Zl 

Zi>(n+d+l)/2 



Z 

Zl>(> 

)/2 / _ ^ 

V I J, (« - of) is odd; 
2" 2^ 2 Zl }(»-^)iseven. 



Pg [Zi 

,=(n+d+l)/2 
j , («W+l)/2 

2 ~ 2" 



(54) 



Zl], 



as n — » oo. 

Furthermore, /1/2 (0, 1) = 1 (setting 5 — > 00). Therefore, 

Pe(») = 0, (60) 

for n — > 00 and 5 — > 00. □ 

(4) Increasing detection probability with distance 

Proof of Theorem 4-iv. Equivalently, we prove that P e (n) de- 
creases with d. Without loss of generality we assume Z/, > 
for all 1 < h < d. The proof will be completed by showing 
that if R(v d ,G„) > R(s*,G n ) then R(y d - U G n ) > R(s*,G„) for 
all d > 2, which is to be verified by contradiction to the 
assumption R(vd,G n ) > R(s*,G n ). 

Suppose R(vd-i,G„) < R(s*,G n ), then Zj_i < n/2. Other- 
wise, Zd-i > n/2 and thus Zh > n/2 for all 1 < h < d — 1; 
namely, Z/,/(n-Z/,) > 1 for all 1 < h < d — 1. Repeatedly 
using (|7), we have 

Zi Z2 Zrf_i 



R(y d - U G n ) = R(s*, G n y 



(61) 



(55) 



=(B-d)/2 

Above, the detailed deduction is in Appendix-G. □ 

(2) Detection probability when 5 — 3 

Proof of Theorem 4-ii. First of all, consider the case when d = 
1. By d46|, the error detection probability is 



P.(lt) = 1-Pc(») 

1 1 1 

4 ~ 4 2L«/2J + 1' 



(56) 



Now, consider the case when d -2. The distribution in ( |28| ) 
can be written as 



h=l 



2(w-zi) 
n(n + l)zi 



(57) 



By Q, we have R(s 2 , G„) = R(s*, G n )^^. If /?(**, G„) < 
R(s2,G„), then zi + Z2 > «■ By ( f53| ), the error detection 
probability as n — » 00 is 

1 f 2 

P.(n) = - J] P g n (Z/l = Z/l) 



Jl+Z2>« 

0.114. 



i,= \ 
2 



+ E p ° (~) (Zh = z/i) 

Zl+Z2>« L/l=l 



(58) 



n — Zi n — Z 2 n — Z^-i 

which leads to the contradiction that /?(vj_i,G„) > R(s*,G„). 
As a result, we have Z^-i < n/2. 

As Zd-\ < n/2, then Zd < n/2 and thus Zd/(n - Zd) < 1. As 
a result, we have 

R(v d ,G„) = R{v d - U G n )^— < R(vd- U G„) < R(s*,G n ), 
n-Z d 

(62) 

which is in contrary to the assumption R(\'d,G„) > R{s*,G„). 



IV. Experiments 

In this section, we carry out simulation experiments under 
three scenarios to study our theoretical predictions. For ver- 
ifying the asymptotic results, in each experiment run we let 
1000 nodes be eventually infected by a rumor source node 
following the SI model, and use the estimator ([3]) to identify 
this source. 

It is shown in Fig. 2 that the correct detection probability is 
increasing with the node degree 5, from virtually zero when 
6 = 2 to 0.307 as 5 exceeds 50. In Fig. 3, there are k 
connected suspect nodes, and the correct detection probability 
significantly exceeds 1/k when 5 > 2. Furthermore, reliable 
detection is achieved as 5 grows large. In Fig. 4, there are 
two suspect nodes with a shortest path distance d, and the 
correct detection probability significantly exceeds 1/2 when 
5 > 2. Furthermore, the detection reliability increases as d 
increases, and reliable detection is also achieved whenever 6 
or d is sufficiently large. 
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Node Degree Node Degree 



Fig. 6. Detection probability when S = V. Fig- 8. Detection probability when S contains two suspect nodes. 



V. CONLUSIONS 

In this paper, we have treated the problem of rooting 
out a single rumor source from a set of suspect nodes and 
constructed an MAP estimator as its solution. For regular 
tree-type networks, we have developed exact and asymp- 
totic performance results of the source estimator under three 
scenarios. First, when all nodes are suspects, the correct 
detection probability is between 0.25 and 0.307 if the network 
is not linear (6 + 2). Second, when the suspects form a 
small connected community, the correct detection probability 
significantly exceeds the a priori probability with 5 + 2, and 
reliable detection is achieved as the node degree becomes 
large. Third, with only two suspect nodes, the correct detection 
probability is at least 0.75 with 5 + 2, and it increases with 
the separation distance between the two suspects. 



Appendix 

A. Proof of Lemma 5 

Proof of Lemma 5. If max{xj, 1 < j < m} < n/2, then by 
Proposition 1 we know that s* is the local rumor center w.r.t. 
the sub-neighborhood Ni(s*) = {s*, . . . , s*,} of G„. Again by 

Proposition 1, we have R{u,G„) < R(s*,G n ) for all u e TK 

' j 

and 1 < j < m. Therefore, we can make sure to correctly 
identify s* as the rumor source. 

If maxjxj, 1 < j < m) = n/2, then by Proposition 1 we know 
that s* is the local rumor center w.r.t. the sub-neighborhood 
Ni(s*) = {«*,..., sj,} of G n . Again by Proposition 1, there 
is only a node u e N/(s*) such that R(u,G n ) = R(s*,G„), 
and R{v,G n ) < R{s*,G n ) for all v e {r£, 1 < j < m) \ {«}}. 
Therefore, the probability to correctly identify s* as the rumor 
source is 1/2. 

If maxjxj, 1 < j < m] > n/2, then by Proposition 1 we know 
that s* is not the local rumor center w.r.t. the sub-neighborhood 
N/(s*) = {Sj, . . . , s* m ) of G„. Therefore, we can not identify s* 
as the rumor source. □ 
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Fig. 7. Detection probability when S forms a connected subgraph of G. 



B. Proof of Equation ( |32) 
When n is even, we have 
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where we use the short form of Pg 

P g 1 < j < 2 . 
By ( [3T| , we have 

i (n-iy. 



, just as 
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When n is odd, we can similarly obtain 
1 / n - 1 

Pc(") = 
In summary, we have 

Pc(») = 



2»- 1 \(n- l)/2 



Above, (a) follows from the fact that events F c { , . . . , F c m are 
disjoint since there is at most a subtree such that the number 
of nodes in it is more than n/2, and (b) from symmetry. □ 
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C. Proof of Equation \35) 
When n is odd, we have 



E. Proof of Equation \A2) 

For m = 2, by Appendix-B, we have 
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For m = 1 and n is even, we have 
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where we use the short form of Pq 
Pg 



just as 



where we use the short form of Pg 

Pg Xj, 1 < j < 2 . 
By ( [4T) , we have 
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a* 1 < j < 3 . 
By ([34b, we have 
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When « is even, we can similarly obtain 
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For m - 1 and n is odd, we can similarly obtain 



In summary, we have 
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D. Proof of Lemma 6 

Proof of Lemma 6. Since the source s* has m (1 < m < (5) 
neighbors in the suspect set S, by Proposition 1 and Lemma 
5 we have 

m m 

Pc(n\s*) > P G =1-P G \Je\ 

i=l i=l 



In summary, we have 
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Proof of Equation ( |46| l 

Here, we only present the detailed proof of ( |46| ) when m = 
2. The case when m = 1 can be deduced in a similar way, and 
the case when m — 3 is the same as that in Appendix-C. 

For m - 2 and n is odd, we have 



(a) 
> 



(b) 



1 - mP f 



Above, (a) is concluded by the union bound over events 
E\, . . . , E c m , and (b) by symmetry. 

Again by Proposition 1 and Lemma 5, we have 
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where we use the short form of Pg 

xj, 1 < j < 3 . 
By (|45]>, we have 



, just as 
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For m = 2 and n is even, we can similarly obtain 



Pc(»|i') = \ + ' 
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In summary, we have 
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G. Proof of Equation \55\ 

Here, we only present the detailed proof of ( |55] l when n is 
odd with even d. The other three cases when n is odd with 
odd d, n is even with even d, and n is even with odd d, can 
be deduced in a similar way. 

Since Zi > (n + d+ l)/2 if and only if R(s*,G n ) < R(s 2 ,G„), 
thus by (|54j> we have 



Pe(«) = 
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H. Proof of Equation ( |58[ ) 

Here, we only present the detailed proof of ( |58j ) when n 
is even. The other case when n is odd can be deduced in a 
similar way. 

Since zi + Zi > n if and only if R(s*,G„) < R(s2, G„). 
Besides, z\ > Zi + 1, thus zi > (n + l)/2. Therefore, by 0% 



we have 
P,(n) : 



\ z p 4h« 
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just as 



where we use the short form of Pq 

Pg z h , I <h<3 . 
As n — > oo, we have 



lim P e (n) ~ 0.114. 
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